Security vulnerabilities in dependencies (spring-security-web, netty, bcpkix)

[Codutie04]

Summary

Several project dependencies contain known security vulnerabilities, including at least one critical issue in spring-security-web. These vulnerabilities are marked as exploitable and should be addressed by upgrading to patched versions.

---

Affected dependencies

🔴 Critical

• spring-security-web - 6.4.13

  • (Critical vulnerability)

🟠 High

• io.netty:netty-codec-http – 4.1.130.Final

  • Advisory: GHSA-pwqr-wmgm-9rr8

• io.netty:netty-codec-http2 – 4.1.130.Final

  • Advisory: GHSA-w9fj-cfpg-grvv

🟡 Medium

• org.bouncycastle:bcpkix-jdk18on – 1.78

  • Advisory: GHSA-4cx2-fc23-5wg6
  • Marked as exploitable

---

Additional context

These issues were identified via GitHub security advisories and are flagged as exploitable as of April 2026.

---

Question

Would you be open to upgrading these dependencies?

---

Many thanks for a feedback.

[LEDfan]

Hi, thanks for opening this issue.

We reviewed the reported CVEs and decided to release an update of ShinyProxy in the coming days. This will take a bit of time since we need to perform extensive testing to make sure there are no regressions.
Feel free to open a PR to bump the versions, but we will take care of it anyway.

Note that we regularly review new CVEs, these specific CVEs were on our radar, and we were reviewing whether to make a new release. For every new release we need to make sure it doesn't cause regressions. For these CVEs there isn't a clear exploit path (and it's not a RCE or similar), so we initially decided to wait for a bigger release (or until new CVEs are available).
(For RCE or similar we'll always release updates immediately).

Just for your information, we provide SLA contracts, which allow you to request an immediate update when a CVE is released (within an agreed timeframe). See our support page if you are interested.
Don't understand me wrong, we'll always release security updates if needed, and these updates will always be open-source and available on our website and GitHub. However, with a SLA you have more control to decide for which CVEs we release an update. Of course, you are free to just use ShinyProxy and open issues if you think there are important CVEs to patch.